composer/composer · error · RuntimeException

Advisory for {name} could not be loaded as a full advisory f

Error message

Advisory for {name} could not be loaded as a full advisory from {repoName}
{data}

What it means

During `composer audit`, ComposerRepository fetches security advisories and tries to build full SecurityAdvisory objects. If the repository returns advisory data that is missing required fields, PartialSecurityAdvisory::create() returns only a partial advisory, and when $allowPartialAdvisories is false (the default full-audit path) it throws RuntimeException, dumping the offending data via var_export. This indicates the advisory source returned incomplete or schema-violating data.

Source

Thrown at src/Composer/Repository/ComposerRepository.php:727

        // respect available-package-patterns / available-packages directives from the repo
        if ($this->hasAvailablePackageList) {
            foreach ($packageConstraintMap as $name => $constraint) {
                if (!$this->lazyProvidersRepoContains(strtolower($name))) {
                    unset($packageConstraintMap[$name]);
                }
            }
        }

        $parser = new VersionParser();
        /**
         * @param array<mixed> $data
         * @param string $name
         * @return ($allowPartialAdvisories is false ? SecurityAdvisory|null : PartialSecurityAdvisory|SecurityAdvisory|null)
         */
        $create = function (array $data, string $name) use ($parser, $allowPartialAdvisories, &$packageConstraintMap): ?PartialSecurityAdvisory {
            $advisory = PartialSecurityAdvisory::create($name, $data, $parser);
            if (!$allowPartialAdvisories && !$advisory instanceof SecurityAdvisory) {
                throw new \RuntimeException('Advisory for '.$name.' could not be loaded as a full advisory from '.$this->getRepoName() . PHP_EOL . var_export($data, true));
            }
            if (!$advisory->affectedVersions->matches($packageConstraintMap[$name])) {
                return null;
            }

            return $advisory;
        };

        if ($this->securityAdvisoryConfig['metadata'] && ($allowPartialAdvisories || $apiUrl === null)) {
            $promises = [];
            foreach ($packageConstraintMap as $name => $constraint) {
                $name = strtolower($name);

                // skip platform packages, root package and composer-plugin-api
                if (PlatformRepository::isPlatformPackage($name) || '__root__' === $name) {
                    continue;
                }

View on GitHub (pinned to 6ffc117740)

Solutions

Update Composer to the latest version in case a newer build tolerates the advisory schema.
Report the malformed advisory data to the repository operator (the dumped data shows which fields are missing).
Temporarily switch to a different advisory source (e.g. the default packagist security feed) if one repository is broken.
Pin the offending package out of the affected version range so the malformed advisory is no longer fetched.

Defensive patterns

Strategy: try-catch

Try / catch

try {
    $result = $repo->getSecurityAdvisories($map, false);
} catch (\RuntimeException $e) {
    if (str_contains($e->getMessage(), 'could not be loaded as a full advisory')) {
        // advisory source returned incomplete data; log and continue without blocking
        $result = ['namesFound' => [], 'advisories' => []];
    } else {
        throw $e;
    }
}

Prevention

Keep Composer up to date so advisory-schema tolerances are current.
Prefer the default packagist advisory feed which is schema-stable.
If you run a private advisory feed, validate its output against the documented schema in CI.

When it happens

Trigger: Running `composer audit` against a repository that advertises security-advisories.metadata but returns advisory entries lacking fields required for a full advisory (e.g. missing cve, reportedAt, or affectedVersions constraint). The error fires inside getSecurityAdvisories() for each offending entry.

Common situations: A private/mirror repository with a buggy advisories feed; upstream advisory data that changed schema; partial mirror that strips fields. Usually not a client-config error but a data-quality problem on the repository side.

Related errors

AI-assisted analysis of composer/composer@6ffc117740 (2026-08-07). Data as JSON: /api/errors/6e18f6b0b461a886. Report an issue: GitHub.